auditctl -1 User ID
I'm getting an auditctl startup SELinux violation that is showing up with a user ID of -1 (4294967295 in my case). I can fix the violation, but before I do I thought I saw something a while back about setting a parameter or defining a variable on power-up so that one didn't get the -1 for something that came up in the wrong order.
I've search blog.gmane.org/gmane.linux.redhat.security.audit and can't seem to find it. Am I all wet or can someone help me with this?
Thanks,
Dan
Quoted 2 lines · Dan Gruhn
I'm getting an auditctl startup SELinux violation that is showing up with a user ID of -1 (4294967295 in my case).
-1 means that the command was run by something that was not initiated by a login. IOW, probably initscripts.
Quoted 3 lines
I can fix the violation, but before I do I thought I saw something a while back about setting a parameter or defining a variable on power-up so that one didn't get the -1 for something that came up in the wrong order.
There is nothing that fixes that. This is just a statement of fact. The error originated from a non-login path. What you might be remembering is that you should put a audit=1 in the boot params of the kernel. This is so that you don't have any unauditable processes.
-Steve
Thanks Steve.
Quoted 20 lines · Steve Grubb
Quoted 3 lines · Dan Gruhn
I'm getting an auditctl startup SELinux violation that is showing up with a user ID of -1 (4294967295 in my case).
-1 means that the command was run by something that was not initiated by a login. IOW, probably initscripts.
Quoted 4 lines
I can fix the violation, but before I do I thought I saw something a while back about setting a parameter or defining a variable on power-up so that one didn't get the -1 for something that came up in the wrong order.
There is nothing that fixes that. This is just a statement of fact. The error originated from a non-login path. What you might be remembering is that you should put a audit=1 in the boot params of the kernel. This is so that you don't have any unauditable processes.
-Steve
Signature · 6 lines
Dan Gruhn Group W Inc. 8315 Lee Hwy, Suite 303 Fairfax, VA, 22031 PH: (703) 752-5831 FX: (703) 752-5851